> Markdown version of [/jobs/ext/2478791-senior-manager-dso-uk-data-incident-investigations-lead](https://www.wearedevelopers.com/jobs/ext/2478791-senior-manager-dso-uk-data-incident-investigations-lead). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Senior Manager - DSO - UK Data Incident Investigations Lead - **Company:** Ernst & Young - **Location:** London, UK - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Software Documentation, Cyber Security, Event Logging - **Published:** August 12, 2026 - **Apply:** https://uk.indeed.com/viewjob?jk=8197cc8362b4abdc ## About the Role * A strong foundational understanding of information security principles is essential. While you don't need to be an engineer, you should be comfortable working with key IT platforms such as Microsoft 365. You must also be proficient in reviewing and analysing security-related data, potentially including event logs, authentication logs and other relevant information. This role requires the ability to assess and interpret security data effectively to identify potential threats and vulnerabilities, triage and resolve incidents and advise management with actionable intelligence. * Professional demeanour with the ability to establish credibility and demonstrate expertise quickly. * Strong incident coordination capability: confident working under pressure and driving disciplined follow-ups across stakeholders. * Strong team player that encourages open communication amongst team members. * Stakeholder management skills across technical and non-technical audiences. * Strong attention to detail and operational rigour to maintain reporting quality, auditability and consistency. To qualify for the role, you must have: * Professional experience delivering triage, incident management or comparable risk-based workflow delivery. * Experience interviewing insider risk actors, witnesses and impacted individuals across both digital and human domains. * An incident investigation professional training or certification, e.g., GIAC Incident Handler. * Expertise in producing structured reporting/MI outputs and maintaining disciplined documentation standards. * Experience of working in a professional services firm or partnership would be beneficial, e.g., understanding of complex matrix organisations, working with colleagues in other functions/organisations or indirect relationships. * A passion for security and technology and identifying and solving problems. * Motivation, commitment and the desire to continue to learn and develop. ## Description * Receive, manage, and investigate referrals of suspected data incidents from defined entry points and ensure required information is captured consistently in the incident management system. * Log and track suspected incidents and maintain triage workflow discipline across multiple concurrent incidents. * Conduct assessments, interviews, and investigations for data incidents to inform escalation decisions and downstream investigation. * Maintain open and proactive operational communication with key stakeholder groups including Data Protection, Forensic, Talent, and Infosec teams with defined escalation pathways to drive structured collaboration through the early incident lifecycle. * Produce and maintain standard incident reporting MI (volume, severity, trends, response timelines) and ensure high documentation quality and consistency. * Ensure timely escalation of incidents in line with defined thresholds and escalation criteria. * Maintain audit ready documentation and ensure complete traceability of triage decisions, evidence and handoffs. * Identifying and mitigating potential security risks and communicate solutions back to project teams. * From time to time, providing advice to the business on good information governance and participating in training and awareness programs. * Ensuring internal policies are maintained and available, and risk assessments are conducted. ## Related Videos - [Is your backend a hodgepodge of queues, event stores and cron jobs? Durable Execution to the Rescue.](https://www.wearedevelopers.com/videos/744-is-your-backend-a-hodgepodge-of-queues-event-stores-and-cron-jobs-durable-execution-to-the-rescue) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [Fake or News: Translating Dog Barks, Notepad Gets an Upgrade and Michelin-Star Robots - Paul Tregoing](https://www.wearedevelopers.com/videos/1802-fake-or-news-translating-dog-barks-notepad-gets-an-upgrade-and-michelin-star-robots-paul-tregoing) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [Cyber Security: Small, and Large!](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large) ## Related Articles - [Data Analyst Salary in the UK](https://www.wearedevelopers.com/magazine/278-data-analyst-salary-in-the-uk) - [Data Engineer Salary UK](https://www.wearedevelopers.com/magazine/253-data-engineer-salary-uk) - [UK Business Culture and Etiquette](https://www.wearedevelopers.com/magazine/326-uk-business-culture-and-etiquette) - [IT Salaries in UK](https://www.wearedevelopers.com/magazine/288-it-salaries-in-uk) - [The Most Popular IT Jobs on the Market](https://www.wearedevelopers.com/magazine/376-the-most-popular-it-jobs-on-the-market) - [The 12 Best Jobs for Software Engineers](https://www.wearedevelopers.com/magazine/401-the-12-best-jobs-for-software-engineers)